Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation

[labkey-willm]

Rationale

LabKey Server's OWASP Dependency Check build is failing on develop with 124 findings, the bulk of them from a handful of vulnerable third-party dependencies. This PR clears the findings that can be resolved by version bumps/forces and suppresses two verified false positives.

Related Pull Requests

• Update ActiveMQ to 5.19.8 for OWASP CVE remediation platform#7824 - companion ActiveMQ 5.19.8 bump (same OWASP remediation)
• Update HttpCore5 to 5.4.3 and HttpClient5 to 5.5.2 (CVE-2026-54399) labkey-api-java#93 - HttpCore5 5.4.3 root fix, first link in the release chain that will clear the labkey-api-jdbc shaded-httpcore5 findings

Changes

• Tomcat 11.0.22 -> 11.0.23: CVE-2026-53434 and CVE-2026-55276 (CRITICAL 9.1), plus CVE-2026-53404, CVE-2026-55955, CVE-2026-55956, CVE-2026-50229
• httpcore5 5.4.2 -> 5.4.3, and a new httpcore5-h2 force at 5.4.3 (previously transitive at 5.3.6): CVE-2026-54399
• Jackson 2.21.4 -> 2.21.5 (jacksonVersion, jacksonDatabindVersion, jacksonJaxrsBaseVersion): CVE-2026-54515
• Suppress classic httpcore 4.x for CVE-2026-54399 (the CVE is scoped to HttpComponents Core 5.x; the 4.x line is EOL and unaffected)
• Suppress Kotlin runtime jars for CVE-2026-53914 (a Kotlin build-cache-metadata deserialization flaw scored 6.7 MEDIUM by JetBrains, not applicable to the shipped stdlib/reflect runtime jars)
• Update comments to document that apacheTomcatVersion is intentionally held ahead of Spring Boot's managed Tomcat

Not included

The two labkey-api-jdbc shaded httpcore5 5.2.4 findings: the vulnerable httpcore5 is shaded inside the published labkey-api-jdbc-3.1.0-all.jar and cannot be overridden via resolutionStrategy. These clear once the release chain lands (labkey-api-java 7.3.0 -> labkey-api-jdbc 3.2.0 -> bump labkeyJdbcVersion here).